// Crypto & passwords
export { timingSafeEqual, encryptSecret, decryptSecret, encryptCredential, decryptCredential } from './crypto'
export { hashPassword, verifyPassword, pbkdf2Derive } from './password'
export type { DeriveBitsFn } from './password'

// JWT & sessions
export { signJwt, verifyJwt } from './jwt'
export {
  signSession,
  verifySession,
  signAdminSession,
  verifyAdminSession,
  SESSION_TTL_SECONDS,
  signImpersonationToken,
  verifyImpersonationToken,
  IMPERSONATION_TTL_SECONDS,
} from './jwt'
export {
  SESSION_COOKIE_OPTS,
  SESSION_COOKIE_NAME,
  buildSessionPayload,
  parseSessionCookie,
} from './session'
export type { Session } from './session'

// contractor-portal: contractor JWT + middleware (server-only — main barrel only)
export {
  signContractorSession,
  verifyContractorSession,
  parseContractorCookie,
  CONTRACTOR_COOKIE_NAME,
  CONTRACTOR_COOKIE_OPTS,
  CONTRACTOR_SESSION_TTL_SECONDS,
  CONTRACTOR_RENEW_THRESHOLD_SECONDS,
} from './contractor-session'
export { contractorAuthMiddleware } from './middleware/contractor-auth'
export type { ContractorAuthVariables } from './middleware/contractor-auth'
export type { ContractorSessionPayload } from '@zync/types'

// tenant-portals: customer portal JWT + stateful session helpers (wave 9b)
export {
  signPortalSession,
  verifyPortalToken,
  parsePortalCookie,
  PORTAL_COOKIE_NAME,
  PORTAL_COOKIE_OPTS,
  PORTAL_SESSION_TTL_SECONDS,
} from './portal/token'
export {
  createPortalSession,
  findActivePortalSession,
  revokePortalSession,
  revokeAllPortalSessions,
  revokeOtherPortalSessions,
  rotatePortalSession,
} from './portal/session'
export type { PortalSessionPayload } from './portal/types'

// RBAC, tier & redirect helpers
export { requirePermission, requireAdminSession, requireTier } from './middleware'

// Rate limiting
export { rateLimit } from './rate-limit'
export type { AuthVariables } from './middleware'
export { meetsMinimumTier, getMaxTeamMembers } from './entitlements'
export { safeRedirect } from './redirect'
export { hasPermission, isAtLeastRole } from './rbac'
export type { Permission } from './rbac'

// Opaque & signed tokens
export {
  generateOpaqueToken,
  hashToken,
  verifyToken,
  signSignedToken,
  verifySignedToken,
  consumeSignedTokenJti,
  PASSWORD_RESET_JTI_PREFIX,
  VERIFY_EMAIL_JTI_PREFIX,
} from './tokens'

// auth-2fa: Firebase phone OTP verification
export { verifyFirebaseIdToken, FirebaseTokenError } from './firebase-verify'
export type { FirebaseUser } from './firebase-verify'
// auth-2fa: backup code generation + verification
export { generateBackupCodes, hashBackupCode, verifyBackupCode } from './backup-codes'
// auth-2fa: phone hashing
export { hashPhoneE164, phoneSuffix } from './phone-hash'
// auth-2fa: shared constants (cookie name, TTLs, KV key prefixes)
export { DEVICE_TRUST_COOKIE_NAME, DEVICE_TRUST_TTL_SECONDS, PENDING_2FA_TOKEN_PREFIX, PENDING_2FA_TTL_SECONDS, BACKUP_CODE_ATTEMPT_KEY_PREFIX, BACKUP_CODE_MAX_ATTEMPTS } from './two-factor'
// auth-2fa: 2FA enforcement middleware
export { require2FAIfEnforced, BYPASS_2FA_GUARD } from './middleware-2fa'

// admin-dashboard: admin permission middleware
export { requireAdminPermission } from './admin-permissions'

// oauth-authorization-code (wave-12): pure crypto + scope helpers
export {
  verifyPKCE,
  base64urlEncode,
  issueConsentToken,
  verifyConsentToken,
  normalizeRequestedScope,
  assertScopesAllowed,
  validateRedirectUri,
  OAuthError,
  ACCESS_TOKEN_PREFIX,
  REFRESH_TOKEN_PREFIX,
  ACCESS_TTL_SECONDS,
  REFRESH_TTL_SECONDS,
  CODE_TTL_SECONDS,
} from './oauth'

// session-security (wave-13): KV blocklist, device-name, login-flow session creation
export {
  sessionRevokedKey,
  blocklistToken,
  isTokenBlocklisted,
  parseDeviceName,
  recordSessionOnLogin,
  blocklistRevokedTokens,
} from './sessions'
export type { RecordSessionOnLoginArgs } from './sessions'